This issue was found by testing another PR (https://github.com/ceph/ceph/pull/12792), which makes MDS directly uses TCMALLOC, not boost::pool. When the version of TCMALLOC is 4.2.6 or above, removing directory will cause MDS crash.

The root cause is that in StrayManager::_purge_stray_logged, inode will delete itself firstly, then it tries to drop dentry via this deleted inode. I think it should be the new version of TCMALLOC to expose this issue more easily and obviously.

The fix here is to reorder the dropping sequence. Tests have passed with following test cases: